As it is known, a communication network comprises three logical main planes, i.e. a data plane, which is the plane suitable for transmitting user data, a control plane, which is the plane suitable for executing control operations, and a management plane, which is the plane suitable for executing management operations.
Managing a communication network provides to perform a number of operations, such as for instance:
monitoring network performance;
configuring network elements and their resources (boards, ports, cross-connections, etc.);
managing errors occurring in the network; etc.
Typically, the management operations are performed by an apparatus which is termed “network management station or system” (or, briefly, NMS), which is connected to each network element of the network to be managed.
In particular, the NMS is provided with a software application which is termed “manager”, capable of exchanging information with software applications which are termed “agent”, which agents are placed at the network elements. Manager and agents exchange each other management information by using a management protocol, which is executed in the management plane and depends on the type of communication network. Examples of management protocols are SNMP (Simple Network Management Protocol), CMIP (Common Management Information Protocol), Q3, and TL1.
Owing to their function, the control plane and the management plane are particularly subjected to attacks by the so-called “hackers”. In the following description and in the claims, the term “attack” will designate an attempt by an hacker to introduce unauthorized software in the communication network and/or to manipulate in a unauthorized way the management and control software managing and controlling the communication network. Possible types of attacks are:
DOS (Denial of Service) attacks, which substantially aim to generate an inefficiency, that could result in a malfunctioning of the network element;
malware reproductions, which aim to open a so-called “backdoor” in the network element, thereby favoring unauthorized accesses; and
diffusion of Trojan horses, worms, key loggers, and virus.
Generally speaking, the data plane is secure as such, as it does not interact in any way with the software applications of the network elements. In other words, user data are transported in a transparent way in the data plane, i.e. the software applications of the network elements do not process the user data.
In the following description and in the claims, the expression “anti-intrusion mechanism-system-method” will designate a mechanism-system-method implemented in a communication network and suitable for isolating one or more network elements which are subjected to an attack from the other network elements of the network. Un elemento di rete soggetto ad un attacco verrà anche indicato “elemento di rete infetto”.
In the art, a number of anti-intrusion mechanisms are known, such as for instance asymmetric cryptography, one-way hash functions, and the like. These known anti-intrusion mechanisms typically provide coding/decoding keys, such as typically a public coding/decoding key, which is known by everybody, and a private coding/decoding key, which is kept secret. The public and private coding/decoding keys are related one to another. In particular, information coded by the public coding key can be decoded only by the corresponding private decoding key, and vice versa information coded by the private coding key can be decoded only by the corresponding public decoding key.